Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
AlmaLinux webkit2gtk3 packages could let attackers run code
published 8 days ago
Summary
The webkit2gtk3 libraries used in AlmaLinux can be tricked into executing malicious code due to several memory handling errors in the underlying Chromium component. This could allow an attacker to take control of the system where these packages are installed. Update the webkit2gtk3, webkit2gtk3-devel, webkit2gtk3-jsc, and webkit2gtk3-jsc-devel packages to the latest versions to protect your systems.
What to do
- Update almalinux webkit2gtk3 to version 2.54.2-0.el9_8.1.
- Update almalinux webkit2gtk3-devel to version 2.54.2-0.el9_8.1.
- Update almalinux webkit2gtk3-jsc to version 2.54.2-0.el9_8.1.
- Update almalinux webkit2gtk3-jsc-devel to version 2.54.2-0.el9_8.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| AlmaLinux:9 | almalinux | webkit2gtk3 |
< 2.54.2-0.el9_8.1 Fix: upgrade to 2.54.2-0.el9_8.1
|
| AlmaLinux:9 | almalinux | webkit2gtk3-devel |
< 2.54.2-0.el9_8.1 Fix: upgrade to 2.54.2-0.el9_8.1
|
| AlmaLinux:9 | almalinux | webkit2gtk3-jsc |
< 2.54.2-0.el9_8.1 Fix: upgrade to 2.54.2-0.el9_8.1
|
| AlmaLinux:9 | almalinux | webkit2gtk3-jsc-devel |
< 2.54.2-0.el9_8.1 Fix: upgrade to 2.54.2-0.el9_8.1
|
Original advisory text
Important: webkit2gtk3 security update
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* chromium-browser: angle: Use after free in ANGLE (CVE-2026-95325)
* chromium-browser: angle: Out of bounds write in ANGLE (CVE-2026-95331)
* chromium-browser: angle: Out of bounds read in ANGLE (CVE-2026-106304)
* chromium-browser: angle: Buffer overflow in ANGLE (CVE-2026-106247)
* chromium-browser: angle: Type confusion in ANGLE (CVE-2026-106293)
* chromium-browser: angle: Uninitialized resource in ANGLE (CVE-2026-106245)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* chromium-browser: angle: Use after free in ANGLE (CVE-2026-95325)
* chromium-browser: angle: Out of bounds write in ANGLE (CVE-2026-95331)
* chromium-browser: angle: Out of bounds read in ANGLE (CVE-2026-106304)
* chromium-browser: angle: Buffer overflow in ANGLE (CVE-2026-106247)
* chromium-browser: angle: Type confusion in ANGLE (CVE-2026-106293)
* chromium-browser: angle: Uninitialized resource in ANGLE (CVE-2026-106245)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://access.redhat.com/errata/RHSA-2026:91580 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-106245 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-106247 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-106293 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-106304 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-95325 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-95331 Third Party Advisory
- https://bugzilla.redhat.com/2543413 Third Party Advisory
- https://bugzilla.redhat.com/2543421 Third Party Advisory
- https://bugzilla.redhat.com/2546829 Third Party Advisory
- https://bugzilla.redhat.com/2546942 Third Party Advisory
- https://bugzilla.redhat.com/2546956 Third Party Advisory
- https://bugzilla.redhat.com/2546958 Third Party Advisory
- https://errata.almalinux.org/9/ALSA-2026-91580.html Vendor Advisory
Timeline
Published28 Oct 2026
Updated29 Oct 2026
First seen29 Oct 2026
Sources
ALSA-2026:91580 · OSV
Track software like this
Free during beta